Live › vulnerability › CVE-2026-111965
Go to dashboardThe Profile Builder WordPress plugin versions 4.0.0 through 4.0.4 do not enforce reCAPTCHA checks on every comment submission path. A logged-in user can bypass the anti-spam check an administrator set up for the WordPress comment form.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running Profile Builder 4.0.0 through 4.0.4 that rely on its reCAPTCHA to stop comment spam. The issue only lets authenticated users skip that check, so sites that allow no user logins or that do not use reCAPTCHA for comments are less exposed.
No product ranges from the sources yet.
wp plugin get profile-builder --field=version4.0.4; the sources do not name the exact fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
This page as .md · .json · in your agent: get_signal("CVE-2026-111965")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.